Bug 2451298 (CVE-2026-3591) - CVE-2026-3591 bind: BIND: Unauthorized access due to use-after-return vulnerability in DNS query handling
Summary: CVE-2026-3591 bind: BIND: Unauthorized access due to use-after-return vulnera...
Keywords:
Status: NEW
Alias: CVE-2026-3591
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2451358 2451359 2451573
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-25 14:01 UTC by OSIDB Bzimport
Modified: 2026-03-26 00:44 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-25 14:01:46 UTC 
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
Comment 2 Petr Menšík 2026-03-25 19:22:49 UTC 
This bug does not affect bind component, but does affect bind9-next component in Fedora only. Bug #2440560 rebase fixes it.
Note You need to log in before you can comment on or make changes to this bug.